forward Splunk logs to syslog server

[pil321]

I have an unusual requirement from my client. To satisfy log retention policies (among other things) I need to send Splunk logs (from the indexer) to a syslog server (RHEL - rsyslog). I have seen many guides on how to send rsyslog files to Splunk, but haven't found anything so far on how to forward logs from Splunk to syslog. I'm only looking to send certain logs, which makes this ideal since Splunk will index what I need to send. I know that this is possible, just need to see an example.

[martin_mueller · Accepted solution]

You're probably looking for this: http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Forwarddatatothird-partysystemsd#Send_a...

[pil321]

Great! Thanks for the help - again!

[martin_mueller]

A heavy forwarder and an indexer are based on the same set of features, so anything one can do can be done by the other as well.

Take a look at the IndexAndForward section in here http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/Outputsconf along with the Syslog section.

I don't have a fully functioning example to post, so far retention within Splunk was sufficient for everyone.

[pil321]

The example shows how to do this from a heavy forwarder. Do you know if it would be possible from an indexer?